0xPThree.gitbook.io
  • Network Services
    • Ports
      • 21 - FTP
      • 22 - SSH
      • 23 - Telnet
      • 25, 465, 587 - SMTP(S)
      • 53 - DNS
      • 80, 443 - HTTP(S)
        • Frameworks
          • Drupal
          • Flask
          • Laravel
          • Tomcat
          • Werkzeug
        • Fuzzing
        • Grafana
        • Languages
          • PHP
        • WebDAV
        • Web Vulnerabilities
          • CloudFlare Bypass
          • Command Injection
          • CSTI
          • File Inclusion/Path Traversal
          • SQL Injection
          • SSI
          • SSTI
          • Upload bypass
          • XLST
          • XML Injection
      • 88 - Kerberos
      • 135, 593 - MSRPC
      • 139, 445 - SMB
      • 161, 162, 10161, 10162 - SNMP
      • 1433, 3306 - SQL
      • 2049 - NFS
      • 2375 - Docker
  • Active Directory
    • ADCS
    • DACL Abuse
      • AddMember
      • ForceChangePassword
      • Kerberoasting
      • ReadLAPSPassword
      • ReadGMSAPassword
      • Grant Ownership
      • Grant Rights
      • Logon Script
      • Rights on RODC object
    • Security groups
    • Misc
  • Coding Languages
    • Python
  • Exploits / PoC's
    • Ansible
      • Ansible AWX
    • Apache
      • HTTP Server - CVE-2021-41773
      • Struts - CVE-2024-53677 / S2-067
      • Tomcat - CVE-2020-1938 / CVE-2020-10487
      • Tomcat - CVE-2025-24813
    • Confluence - CVE-2023-22527
    • CUPS - CVE-2024-47***
    • D-Link
      • CVE-2020-29322
      • Decrypt firmware: DIR-X1560
    • Dmidecode - CVE-2023-30630
    • Erlang
      • OTP SSH - CVE-2025-32433
    • EternalBlue - MS17-010
    • Gitlab - CVE-2023-7028
    • Ivanti - CVE-2024-21893 / 21887
    • Jenkins - CVE-2024-23897
    • LXD group - N/A
    • nf_tables - CVE-2024-1086
    • NFS - N/A
    • Oracle
      • WebLogic - CVE-2018-2628
      • WebLogic - CVE-2019-2729
      • WebLogic - CVE-2023-21839
      • WebLogic - CVE-2024-20931
      • WebLogic - CVE-2024-21006
    • PHP
      • CVE-2024-4577
    • RunC
      • CVE-2022-0811
      • CVE-2024-21626
    • Snap - CVE-2019-7304
    • TP-Link - CVE-2024-5035
  • Hardware
    • Firmware
    • JTAG
    • SPI
    • UART
    • USB
  • Post Exploit
    • Compile payload
    • Obfuscation
    • Read VMDK files
    • Saved Credentials
      • Linux - Ansible AWX / Tower
      • Linux - Dell Networker
      • Windows - Mozilla Firefox
      • Windows - Notepad++
      • Windows - WinSCP
    • Session Hijack
    • Sniffing Passwords
    • Upgrade shell
    • VMware
      • Disk Encryption
      • LDAP Connection (SSO)
      • Restore VCSA Postgres Database
      • vCenter Forge SAML
      • Waiter Account Information
  • Development
    • Dnsmasq DHCP
    • Docker
      • Ansible AWX
      • Docker Compose
      • FirmAE - Emulate Firmware
      • Oracle WebLogic
      • Rocket.Chat
      • Tomcat
      • Vaultwarden
    • Harden Windows Host
    • HTTPS Proxy
    • Netplan + Networkd
    • SSL/TLS Certificates
  • TODO
Powered by GitBook
On this page
  • Debian-based (glibc)
  • Alpine-based (libc.musl)

Was this helpful?

  1. Post Exploit

Compile payload

Last updated 6 months ago

Was this helpful?

Compiling payload on the local host which is going to be executed on a remote victim often comes errors in form of version mismatch. Below is a quick way to solve it.

Debian-based (glibc)

  1. Find information about the target.

aas@Leakage:/tmp$ cat /etc/os-release  | grep -i pretty
PRETTY_NAME="Ubuntu 18.04.3 LTS"

aas@Leakage:/tmp$ ls -al /lib/x86_64-linux-gnu/libc.so.6
lrwxrwxrwx 1 root root 12 Apr 16  2018 /lib/x86_64-linux-gnu/libc.so.6 -> libc-2.27.so
  1. Create a Dockerfile with the same image or libc-version.

Ubuntu images:

## Dockerfile
FROM ubuntu:18.04 as dev

## Install build-essential and copy files to container
RUN apt update && apt install -y build-essential
WORKDIR /src
COPY . /src/

## Build the binary
FROM dev as build
RUN CGO_ENABLED=0 gcc -o cve exploit.c

## Copy binary from container to host
FROM scratch as artifact
COPY --from=build /src/cve ./cve

FROM release
  1. Build the payload using DOCKER_BUILDKIT

utv-kali :: /tmp/test » DOCKER_BUILDKIT=1 docker build --target artifact --output type=local,dest=. . --network=host
[+] Building 12.4s (11/11) FINISHED                                                                                                                           
 => [internal] load build definition from Dockerfile                                                                                                     0.0s
 => => transferring dockerfile: 460B                                                                                                                     0.0s
 => [internal] load .dockerignore                                                                                                                        0.0s
 => => transferring context: 2B                                                                                                                          0.0s
 => [internal] load metadata for docker.io/library/ubuntu:18.04                                                                                          0.5s
 => [internal] load build context                                                                                                                        0.0s
 => => transferring context: 483B                                                                                                                        0.0s
 => CACHED [dev 1/4] FROM docker.io/library/ubuntu:18.04@sha256:152dc042452c496007f07ca9127571cb9c29697f42acbfad72324b2bb2e43c98                         0.0s
 => [dev 2/4] RUN apt update && apt install -y build-essential                                                                                          11.8s
 => [dev 3/4] WORKDIR /src                                                                                                                               0.0s 
 => [dev 4/4] COPY . /src/                                                                                                                               0.0s 
 => [build 1/1] RUN CGO_ENABLED=0 gcc -o cve exploit.c                                                                                                   0.1s 
 => [artifact 1/1] COPY --from=build /src/cve ./cve                                                                                                      0.0s 
 => exporting to client                                                                                                                                  0.0s 
 => => copying files 13.16kB                                                                                                                             0.0s
 
utv-kali :: /tmp/test » ls -al
total 28
drwxrwxr-x  2 void void   100 Nov  2 14:22 .
drwxrwxrwt 39 root root   860 Nov  2 15:55 ..
-rw-rw-r--  1 void void   342 Nov  2 14:17 Dockerfile
-rwxr-xr-x  1 void void 13136 Nov  2 14:03 cve
-rw-rw-r--  1 void void  6312 Nov  2 13:08 exploit.c


Alpine-based (libc.musl)

## Dockerfile
FROM frolvlad/alpine-glibc:glibc-2.27 as dev

## Install builder-base and copy files to container
RUN apk add build-base
WORKDIR /src
COPY . /src/

## Build the binary
FROM dev as build
RUN CGO_ENABLED=0 gcc -o cve exploit.c

## Copy binary from container to host
FROM scratch as artifact
COPY --from=build /src/cve ./cve

FROM release

Build the payload with the same commands as in the above example.

Useful images:

https://hub.docker.com/_/ubuntu/tags
https://hub.docker.com/r/frolvlad/alpine-glibc/tags